Details
P1: Critical Description
Calling QQmlListReference::replace() on QQuickWindow::data property causes a crash in Qt 6.5.2+.
It is due to this change: https://code.qt.io/cgit/qt/qtdeclarative.git/commit/src/quick/items/qquickitem.cpp?h=6.5.2&id=9100ed3f8872cf59d77698fabb57e0452eceaee1
The QQuickItem::data property no longer supports the replace operation.
QQuickWindow::data_replace still tries to forward the call to QQuickItem, but the replace function pointer is now null. https://code.qt.io/cgit/qt/qtdeclarative.git/tree/src/quick/items/qquickwindow.cpp?h=dev#n1916
It can be reproduced from QML as well:
import QtQuick import QtQuick.Controls Window { id: window width: 640 height: 480 visible: true title: qsTr("data") Rectangle { color: "green" width: 300 height: 300 } Rectangle { color: "red" width: 200 height: 200 } Rectangle { color: "blue" width: 100 height: 100 } Button { text: "Remove" onClicked: window.data[1] = null } }
This crashes with 6.5.2 and later but not earlier versions.
Same if using QQmlListReference from C++:
#include <QGuiApplication> #include <QQmlApplicationEngine> #include <QQmlListReference> int main(int argc, char *argv[]) { QGuiApplication app(argc, argv); QQmlApplicationEngine engine; QObject::connect(&engine, &QQmlApplicationEngine::objectCreationFailed, &app, []() { QCoreApplication::exit(-1); }, Qt::QueuedConnection); engine.load("qrc:/WindowDataPropertyTest/Main.qml"); auto obj = engine.rootObjects().constFirst(); QQmlListReference ref(obj, "data"); if(ref.canReplace()) { ref.replace(1, nullptr); } else { qDebug() << "Replace not supported"; } return app.exec(); }
This should print "Replace not supported" now but crashes instead.
